CVE-2026-66454

MediumCVSS 6.5

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

16th percentile - higher than 16% of all known CVEs

Broken Access Control vulnerability in WP Social Avatar versions up to 1.5, exploitable without authentication.

Unauthenticated users can access administrative functions, potentially leading to modification of settings or privilege escalation.

Update the WP Social Avatar plugin to the latest patched version.

Original NVD description (English source)

Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.